Applications Azure

Apache Superset 6 on Ubuntu 24.04 on Azure User Guide

Last updated: 2026-04-30 | Product: Apache Superset 6 on Ubuntu 24.04 LTS on Azure

Overview

This guide covers the deployment and configuration of Apache Superset 6 on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Superset is a modern open source data exploration and visualization platform with a rich SQL IDE, drag-and-drop chart builder, and dashboard sharing — connect it to any SQLAlchemy-compatible engine and let business users author dashboards in minutes.

The image ships Apache Superset 6.0.0 in a dedicated Python 3.12 virtual environment at /opt/superset/venv, backed by PostgreSQL 16 (metadata DB) and Redis 7 (cache + Celery results backend). Two systemd units run the workload: superset.service (gunicorn, 2 workers x 8 threads, port 8088) and superset-celery.service (Celery worker for asynchronous SQL Lab queries). On every fresh customer virtual machine, superset-firstboot.service rotates the application SECRET_KEY, the PostgreSQL superset role password, and the admin user password to per-VM strong values. Credentials are written to /stage/scripts/superset-credentials.log (mode 0600, root only). No two virtual machines ever share a SECRET_KEY or admin password; no secret is baked into the image.

What is included:

Apache Superset 6.0.0 installed via pip into a Python 3.12 venv at /opt/superset/venv
superset.service (gunicorn) and superset-celery.service (Celery worker) systemd units auto-starting on boot
superset-firstboot.service systemd oneshot that rotates SECRET_KEY, DB password, and admin password on first boot
PostgreSQL 16 from the Ubuntu 24.04 main repo as the metadata database (database superset, role superset)
Redis 7 from the Ubuntu 24.04 main repo as the cache and Celery results backend
Listener on TCP 8088 (HTTP) bound to 0.0.0.0
Pre-configured /etc/superset/superset_config.py with Redis-backed cache, async Celery, and proxy fix enabled
Ubuntu 24.04 LTS base with latest security patches applied at build time
Azure Linux Agent for seamless cloud integration and SSH key injection
24/7 cloudimg support with guaranteed 24 hour response SLA

Prerequisites

An active Azure subscription
A subscription to the Apache Superset 6 on Ubuntu 24.04 listing on Azure Marketplace
An SSH public key for VM authentication
A virtual network and subnet in the target region

Recommended virtual machine size: Standard_D2s_v5 (2 vCPU, 8 GB RAM) for small deployments serving up to ten concurrent users. Scale up to Standard_D4s_v5 for fleets serving more than fifty dashboards or with heavy ad-hoc query load. The minimum supported size is Standard_B2s (2 vCPU, 4 GB RAM) but on B2s memory pressure may evict the Celery worker under sustained load — D2s_v5 or larger is recommended for production.

Step 1: Deploy from the Azure Portal

Navigate to Marketplace in the Azure Portal, search for Apache Superset 6, select the cloudimg publisher entry, and click Create.

On the Networking tab attach a network security group that allows inbound TCP 22 from your management IP range and TCP 8088 from your trusted client networks. Do not expose port 8088 to the public internet without TLS — Superset ships listening on plain HTTP by design (terminate TLS at a reverse proxy). The cloudimg nginx-ssl-certbot-ubuntu-24-04 image makes a good companion reverse proxy.

Click Review + create, wait for validation, then Create. Deployment takes around two minutes.

Step 2: Deploy from the Azure CLI

RG="superset-prod"
LOCATION="eastus"
VM_NAME="superset-01"
ADMIN_USER="azureuser"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/superset-6-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"

az group create --name "$RG" --location "$LOCATION"

az network vnet create \
  --resource-group "$RG" \
  --name superset-vnet --address-prefix 10.94.0.0/16 \
  --subnet-name superset-subnet --subnet-prefix 10.94.1.0/24

az network nsg create --resource-group "$RG" --name superset-nsg

az network nsg rule create \
  --resource-group "$RG" --nsg-name superset-nsg \
  --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 22 --access Allow --protocol Tcp

az network nsg rule create \
  --resource-group "$RG" --nsg-name superset-nsg \
  --name allow-superset --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 8088 --access Allow --protocol Tcp

az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_D2s_v5 --storage-sku StandardSSD_LRS \
  --admin-username "$ADMIN_USER" --ssh-key-values "$SSH_KEY" \
  --vnet-name superset-vnet --subnet superset-subnet --nsg superset-nsg \
  --public-ip-sku Standard

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

superset.service and superset-celery.service will already be running and superset-firstboot.service will already have rotated the admin password to a per-VM value.

Step 4: Verify the Superset Services

sudo systemctl is-active superset.service superset-celery.service postgresql redis-server

Expected output (one line per service, all active):

active
active
active
active

Confirm the firstboot sentinel:

sudo test -f /var/lib/cloudimg/superset-firstboot.done && echo FIRSTBOOT_DONE

Confirm the listener on port 8088:

sudo ss -tln | grep 8088

Confirm the API responds healthy:

curl -s -o /dev/null -w "HEALTH=%{http_code}\n" http://localhost:8088/health

You should see HEALTH=200.

superset.service active and listening on TCP 8088

Step 5: Retrieve the Admin Password

sudo cat /stage/scripts/superset-credentials.log

You will see (passwords redacted in the example below — your VM has unique per-VM values):

admin_username=admin
admin_password=<ADMIN_PASSWORD>
db_password=<DB_PASSWORD>

Store the admin password in your secret store. The file is mode 0600 (root only).

Apache Superset 6 version 6.0.0 reported by superset version, /health returning 200

Step 6: First Login

Open http://<vm-ip>:8088/login/ in your browser. You will see the Superset 6 sign in page:

Apache Superset 6 sign in page on a freshly deployed cloudimg VM

Sign in with admin and the password from Step 5. After login Superset lands on the welcome dashboard with quick links to add a database, browse SQL Lab, and create your first chart:

Superset welcome dashboard immediately after first login on a freshly deployed cloudimg VM

Recommended: change the admin password again from the UI (Settings → Information → admin → Reset Password), and create per-user accounts under Settings → List Users so production workflows do not run as the shared admin.

Step 7: Add a Database Connection

Navigate to Settings → Database Connections in the top right. On a fresh VM the list is empty — click + Database to open the connection wizard:

Empty Database Connections page on a freshly deployed Superset VM, before any external sources have been added

Pick from the built-in options. Common Azure pairings:

PostgreSQL — pair with the cloudimg postgresql-18-pgadmin-ubuntu-24-04 image, or point at an Azure Database for PostgreSQL Flexible Server
MySQL / MariaDB — pair with the cloudimg mysql-9-7-lts-ubuntu-24-04 or mariadb-11-ubuntu-24-04 images, or point at Azure Database for MySQL
Microsoft SQL Server — pair with a cloudimg SQL Server image or Azure SQL Managed Instance; the mssql+pyodbc driver is included
Snowflake / BigQuery / Redshift — cloud data warehouse connectors are included; provide a service account JSON or username and password as appropriate
ClickHouse / Druid / Trino / Presto — modern OLAP engines are first-class in Superset 6

After adding a database, click Test Connection then Connect to save.

Step 8: SQL Lab and Your First Chart

The SQL Lab IDE is the fastest path from query to chart. Navigate to SQL → SQL Lab in the top nav, pick the database you added in Step 7, write a query, and run it:

Superset SQL Lab IDE with a query against the metadata database returning rows

Click Save → Save Dataset to persist the query as a logical dataset. From the dataset you can click Create Chart to open the explore view, pick a chart type (bar, line, pie, table, big number, time-series, geographic, etc.), drag dimensions and metrics into the configuration pane, and Save the chart to a dashboard.

The Celery worker (running on the same VM as part of superset-celery.service) handles asynchronous SQL Lab queries that exceed SQLLAB_TIMEOUT_SEC so long-running analytical queries do not block the gunicorn web workers.

Step 9: Put TLS in Front (Production)

Superset 6 listens on plain HTTP by design. For production, terminate TLS at a reverse proxy. Two common paths:

Path A — Caddy / Nginx on the same VM:

sudo apt-get install -y nginx

Configure /etc/nginx/sites-available/superset.conf with proxy_pass http://localhost:8088; and bind nginx :443 to a real cert. Enable ENABLE_PROXY_FIX = True is already set in /etc/superset/superset_config.py so Superset will respect the X-Forwarded-Proto header.

Path B — Azure Application Gateway in front:

Create an Application Gateway with TLS termination and route the backend pool at the VM private IP on port 8088. Restrict the NSG to allow inbound 8088 from the App Gateway subnet only.

The cloudimg nginx-ssl-certbot-ubuntu-24-04 image is purpose-built for Path A — deploy it on a separate small VM and point it at this Superset VM's private IP.

Step 10: Server Components

Component	Path
Superset Python venv	`/opt/superset/venv/`
Superset CLI	`/opt/superset/venv/bin/superset`
Application config	`/etc/superset/superset_config.py`
Environment file	`/etc/superset/superset.env`
Working directory	`/var/lib/superset/`
Log directory	`/var/log/superset/`
Gunicorn unit	`/etc/systemd/system/superset.service`
Celery unit	`/etc/systemd/system/superset-celery.service`
Firstboot script	`/usr/local/sbin/superset-firstboot.sh`
Firstboot service	`/etc/systemd/system/superset-firstboot.service`
Credentials file	`/stage/scripts/superset-credentials.log`
Firstboot sentinel	`/var/lib/cloudimg/superset-firstboot.done`
PostgreSQL data	`/var/lib/postgresql/16/main/`
Redis config	`/etc/redis/redis.conf`

Inspect the installed Superset version:

set -a; sudo . /etc/superset/superset.env; set +a
cd /var/lib/superset && sudo -u superset env \
    SUPERSET_SECRET_KEY="$SUPERSET_SECRET_KEY" \
    SUPERSET_DB_PASSWORD="$SUPERSET_DB_PASSWORD" \
    PYTHONPATH=/etc/superset FLASK_SKIP_DOTENV=1 \
    /opt/superset/venv/bin/superset version | sed 's/\x1b\[[0-9;]*m//g' | grep -E '^Superset '

You should see Superset 6.0.0.

Superset metadata DB schema initialised — alembic_version table present in PostgreSQL

Step 11: Managing the Services

Status:

sudo systemctl status superset.service --no-pager | head -n 15

Stop / Start / Restart:

sudo systemctl stop superset.service superset-celery.service
sudo systemctl start superset.service superset-celery.service
sudo systemctl restart superset.service superset-celery.service

View gunicorn logs:

sudo tail -n 50 /var/log/superset/gunicorn.log

View Celery worker logs:

sudo tail -n 50 /var/log/superset/celery.log

Reset admin password (e.g. if you lose it):

The cleanest path is to use the Superset CLI with the env file sourced. Substitute your new password for <new-password>:

set -a; sudo . /etc/superset/superset.env; set +a
cd /var/lib/superset && sudo -u superset env \
    SUPERSET_SECRET_KEY="$SUPERSET_SECRET_KEY" \
    SUPERSET_DB_PASSWORD="$SUPERSET_DB_PASSWORD" \
    PYTHONPATH=/etc/superset FLASK_SKIP_DOTENV=1 \
    /opt/superset/venv/bin/superset fab reset-password \
    --username admin --password '<new-password>'

Step 12: Scaling and Tuning

For higher load, edit /etc/systemd/system/superset.service and increase the gunicorn worker count. The starting configuration is -w 2 -k gthread --threads 8; for D4s_v5 (4 vCPU, 16 GB RAM) raise to -w 4 --threads 8. Restart the service after editing.

For more aggressive caching, raise CACHE_DEFAULT_TIMEOUT in /etc/superset/superset_config.py from 300 seconds to 3600 or more for slowly-changing data sources.

For Celery worker concurrency, edit /etc/systemd/system/superset-celery.service and raise -c 2 to match your vCPU count. Restart after editing.

Step 13: Backup and Restore

The Superset metadata database lives in PostgreSQL 16 on the same VM, in the superset database. Back it up with pg_dump:

sudo -u postgres pg_dump -Fc superset > /var/backups/superset-metadata.dump

Restore on a new VM with pg_restore after stopping the gunicorn service. Substitute <backup-dir> for the directory holding your dump file:

sudo systemctl stop superset.service superset-celery.service
sudo -u postgres pg_restore -d superset --clean --if-exists <backup-dir>/superset-metadata.dump
sudo systemctl start superset.service superset-celery.service

For production, schedule a nightly pg_dump to Azure Blob Storage with azcopy.

Step 14: Troubleshooting

Cannot reach Superset on port 8088

Confirm services running: sudo systemctl is-active superset.service superset-celery.service
Confirm listener bound: sudo ss -tln | grep 8088
Check log: sudo tail -n 50 /var/log/superset/gunicorn.log
Confirm NSG allows TCP 8088 from your client source IP

Lost admin password

Use Step 11's superset fab reset-password command
The credentials file at /stage/scripts/superset-credentials.log contains the password generated at firstboot — read with sudo cat

SQL Lab queries time out

Check the Celery worker is running: sudo systemctl is-active superset-celery.service
Check Redis is running: sudo systemctl is-active redis-server
Tail Celery log: sudo tail -n 50 /var/log/superset/celery.log
Raise the gunicorn timeout in /etc/systemd/system/superset.service from --timeout 120 to --timeout 300 and restart

Service fails to start

Check journal: sudo journalctl -u superset.service --no-pager -n 100
Check environment file is present: ls -l /etc/superset/superset.env
Verify the metadata DB is reachable: sudo -u postgres psql -d superset -c '\dt' | head
Check disk space: df -h /var/lib/superset

Step 15: Security Recommendations

Change the admin password again from the UI after first login
Create per-user accounts under Settings → List Users; never share the admin login
Restrict port 22 to your management IP ranges only
Restrict port 8088 to trusted client networks only; pair with TLS via Step 9 for any non-trivial deployment
Enable Single Sign-On through the Flask-AppBuilder OAuth or LDAP integration for production deployments
Schedule nightly backups of the PostgreSQL metadata DB (Step 13) to Azure Blob Storage
Keep Superset updated within the 6.x line by activating the venv and running pip install --upgrade "apache-superset==6.x.y" periodically (replace 6.x.y with the latest 6 release), then restart the services
Shred the credentials file once the password is stored in your secret store: sudo shred -u /stage/scripts/superset-credentials.log

Step 16: Support and Licensing

Apache Superset is licensed under the Apache License 2.0. There is no per-user, per-dashboard, or per-server fee. Apache Superset is a trademark of the Apache Software Foundation.

cloudimg provides commercial support for this image separately from the upstream project.

Email: support@cloudimg.co.uk
Website: www.cloudimg.co.uk
Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on Azure

Launch Apache Superset 6 on Ubuntu 24.04 with 24/7 support from cloudimg.

View on Marketplace

Need Help?

Our support team is available 24/7.

support@cloudimg.co.uk